I'm a Linux newbie. I have a PHP script which, based on the correctness of a few parameters, decides whether to serve a file to the user or not. I'm serving files through the XSendFile feature in nginx. I'd like to block direct access to files so that the user is forced to download them through the PHP script.
My problem is that if I set the files permissions to 640, when I try to download directly I get a 403 Forbidden, but I'm unable to download it with the script as well. Whereas if I set it to 644, I'm able to do both things (I thought one needed to add the Execute permission to enable direct download of a file. Was I wrong?) How should I setup permissions to achieve what I need?
Edit: Note that I can't move the files above the web root directory, because some files must have direct access while others must not. So I have to keep them all in the same directory and be able to enable/disable direct downloading selectively.